What passed, on what system
This is the reference MyPrivateClaw profile. We ran it from an empty disposable Ubuntu 24.04.4 VM on August 24, 2026: x86-64, 6 virtual CPUs, 16 GiB RAM, 35 GiB disk, and no GPU. Ollama ran Qwen 3.5 9B at a measured 64,000-token context and Hermes returned the exact end-to-end marker. The model occupied about 8.6 GB and the VM used about 9.8 GB RAM during the check. The full cold validation took about 7 minutes 22 seconds; the Hermes CPU-only reply took roughly four minutes.
Get more guides like this in your inbox
No spam. Unsubscribe anytime.
Why Ollama is the reference runtime
Ollama is the reference because it has the shortest reliable path from a local model to Hermes' OpenAI-compatible endpoint. llama.cpp remains the optimization lab and vLLM is the Linux GPU/high-throughput track. Hermes' own provider documentation says local Ollama works through http://127.0.0.1:11434/v1 and that agent use requires at least 64,000 tokens. The 64K requirement matters more than a flashy short-prompt benchmark.
1. Preflight the Ubuntu host
Use Ubuntu 24.04 on x86-64 with at least 16 GiB RAM and 25 GiB free disk for this 9B profile. The commands below intentionally stop if the architecture or capacity is wrong. Use a normal sudo-capable account.
set -euo pipefail
test "$(uname -m)" = x86_64
grep -Fq 'VERSION_ID="24.04"' /etc/os-release
free -h
df -h /
sudo apt-get update
sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl git jq zstd2. Install the exact Ollama release
Download the official v0.32.14 Linux archive, verify its SHA-256 before extraction, and install only after the digest passes. This avoids a floating installer and makes the tutorial reproducible.
OLLAMA_VERSION=0.32.14
OLLAMA_ARCHIVE=ollama-linux-amd64.tar.zst
OLLAMA_SHA256=c620917a71e146ab3a7f893084f066069c4c65d144ef8379a91c3cbe8b27de8f
curl --fail --show-error --location --retry 3 --proto '=https' --tlsv1.2 \
"https://github.com/ollama/ollama/releases/download/v${OLLAMA_VERSION}/${OLLAMA_ARCHIVE}" \
-o "/tmp/${OLLAMA_ARCHIVE}"
printf '%s %s\n' "$OLLAMA_SHA256" "/tmp/$OLLAMA_ARCHIVE" | sha256sum -c -
tar --zstd -tf "/tmp/$OLLAMA_ARCHIVE" >/dev/null
sudo tar --zstd -xf "/tmp/$OLLAMA_ARCHIVE" -C /usr
ollama --version3. Create the 64K Ollama service
Hermes rejects a smaller agent context. Run Ollama as an unprivileged system user, bind to its default loopback endpoint, and set 64,000 server-side. Do not expose port 11434 to the LAN.
getent group ollama >/dev/null || sudo groupadd --system ollama
id ollama >/dev/null 2>&1 || sudo useradd --system --gid ollama \
--home-dir /usr/share/ollama --create-home --shell /usr/sbin/nologin ollama
sudo tee /etc/systemd/system/ollama.service >/dev/null <<'EOF'
[Unit]
Description=Ollama Service
After=network-online.target
[Service]
ExecStart=/usr/bin/ollama serve
User=ollama
Group=ollama
Restart=on-failure
RestartSec=3
Environment="OLLAMA_CONTEXT_LENGTH=64000"
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now ollama
sudo systemctl is-active ollama
curl --fail --silent http://127.0.0.1:11434/api/tags | jq .4. Verify and pull the exact Qwen profile
Ollama's CLI accepts a model tag, not the registry digest in the way users reasonably expect. Therefore verify the registry manifest before and after the pull, then verify the model blob itself. If either digest changes, stop and re-review the profile.
MODEL=qwen3.5:9b
MANIFEST_URL=https://registry.ollama.ai/v2/library/qwen3.5/manifests/9b
MANIFEST_SHA256=6488c96fa5faab64bb65cbd30d4289e20e6130ef535a93ef9a49f42eda893ea7
MODEL_BLOB_SHA256=dec52a44569a2a25341c4e4d3fee25846eed4f6f0b936278e3a3c900bb99d37c
curl --fail --show-error --location "$MANIFEST_URL" -o /tmp/qwen35-manifest-before.json
printf '%s %s\n' "$MANIFEST_SHA256" /tmp/qwen35-manifest-before.json | sha256sum -c -
ollama pull "$MODEL"
curl --fail --show-error --location "$MANIFEST_URL" -o /tmp/qwen35-manifest-after.json
printf '%s %s\n' "$MANIFEST_SHA256" /tmp/qwen35-manifest-after.json | sha256sum -c -
cmp /tmp/qwen35-manifest-before.json /tmp/qwen35-manifest-after.json
MODEL_BLOB=/usr/share/ollama/.ollama/models/blobs/sha256-${MODEL_BLOB_SHA256}
sudo test -f "$MODEL_BLOB"
sudo sh -c "printf '%s %s\\n' '$MODEL_BLOB_SHA256' '$MODEL_BLOB' | sha256sum -c -"5. Prove Ollama inference before adding Hermes
This checkpoint separates model/runtime failures from harness failures. It must return true and include MPC_OLLAMA_OK.
curl --fail --show-error http://127.0.0.1:11434/api/chat \
-H 'Content-Type: application/json' \
-d '{"model":"qwen3.5:9b","stream":false,"think":false,"messages":[{"role":"user","content":"Reply with exactly MPC_OLLAMA_OK"}]}' \
| tee /tmp/ollama-smoke.json
jq -e '.done == true and (.message.content | contains("MPC_OLLAMA_OK"))' /tmp/ollama-smoke.json6. Install Hermes from an exact commit and frozen lockfile
Hermes 0.20.1 is the newest release old enough for this validation policy on August 24. Fetch the exact commit, use the verified uv release, and restore dependencies with --locked. Do not replace these pins with latest.
UV_VERSION=0.11.17
UV_ARCHIVE=uv-x86_64-unknown-linux-gnu.tar.gz
UV_SHA256=0017ccecaeb4d431d7f93b583ebff0c5c38e00eb734fcf13d05f72ca419125fe
curl --fail --show-error --location --retry 3 \
"https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/${UV_ARCHIVE}" \
-o "/tmp/$UV_ARCHIVE"
printf '%s %s\n' "$UV_SHA256" "/tmp/$UV_ARCHIVE" | sha256sum -c -
mkdir -p /tmp/uv-bin
tar -xzf "/tmp/$UV_ARCHIVE" -C /tmp/uv-bin --strip-components=1
/tmp/uv-bin/uv --version
HERMES_COMMIT=f80f453ae0679347e38abc917c7f94f717bf96c5
HERMES_DIR=$HOME/.hermes/hermes-agent
mkdir -p "$HOME/.hermes"
git init "$HERMES_DIR"
git -C "$HERMES_DIR" remote add origin https://github.com/NousResearch/hermes-agent.git
git -C "$HERMES_DIR" fetch --depth 1 origin "$HERMES_COMMIT"
git -C "$HERMES_DIR" checkout --detach FETCH_HEAD
test "$(git -C "$HERMES_DIR" rev-parse HEAD)" = "$HERMES_COMMIT"
(cd "$HERMES_DIR" && /tmp/uv-bin/uv sync --locked --no-dev --python /usr/bin/python3)
HERMES_BIN=$HERMES_DIR/.venv/bin/hermes
"$HERMES_BIN" --version7. Configure Hermes for the local endpoint
Write only the minimal local provider configuration. The api_key value is inert; Ollama does not authenticate loopback requests, but the OpenAI client expects a non-empty value.
HERMES_DIR=${HERMES_DIR:-$HOME/.hermes/hermes-agent}
"$HERMES_DIR/.venv/bin/python" - "$HOME/.hermes/config.yaml" <<'PY'
from pathlib import Path
import yaml
config = {"model": {
"default": "qwen3.5:9b",
"provider": "custom",
"base_url": "http://127.0.0.1:11434/v1",
"api_key": "no-key",
"context_length": 64000,
"max_tokens": 2048,
}}
Path(__import__('sys').argv[1]).write_text(yaml.safe_dump(config, sort_keys=False))
PY
chmod 0600 "$HOME/.hermes/config.yaml"
"$HERMES_DIR/.venv/bin/hermes" config check8. Run the end-to-end acceptance check
On the tested CPU VM this cold call took about four minutes, so the timeout is intentionally generous. Passing means the exact marker is returned and ollama ps reports a context of at least 64000. A short response without the context check is not a pass.
HERMES_BIN=${HERMES_DIR:-$HOME/.hermes/hermes-agent}/.venv/bin/hermes
HERMES_API_TIMEOUT=690 timeout 720 "$HERMES_BIN" -z \
'Reply with exactly MPC_HERMES_OLLAMA_OK and no other text.'
ollama ps
# PASS: exact marker returned and CONTEXT is 64000 or greater.Profile status and maintenance rule
Status: PASS for Ubuntu 24.04.4 x86-64, 6 vCPU, 16 GiB RAM, CPU-only. Status: EXPERIMENTAL for Qwen 3.8 27B MLX on a 36 GB M4 Max Mac: the signed runtime, all 1,210 model blobs, and direct inference passed, but Hermes at 64K exceeded a seven-minute timeout. Re-run every acceptance check before changing Ollama, Hermes, the model manifest, context length, or hardware tier. Never turn a vendor benchmark into a MyPrivateClaw performance claim without a local reproduction.